Plack::Middleware::XSendfile versions through 1.0053 allow an attacker to control the sendfile type via the X-Sendfile-Type HTTP header. Specifically, if the middleware constructor or Plack environment does not restrict this, an attacker can set the header to "X-Accel-Redirect" to target services behind nginx reverse proxies. By also setting the X-Accel-Mapping header, the attacker can cause the server to serve arbitrary files, leading to exposure of sensitive information. Although some mitigations exist to disallow regular expressions in mappings and limit the mapping application to the "X-Accel-Redirect" type, the vulnerability remains exploitable. The middleware is deprecated and slated for removal in future releases.

The vulnerability enables unauthorized actors to read arbitrary files on the server by manipulating HTTP headers, potentially exposing sensitive information. This exposure could lead to information disclosure that might aid further attacks or compromise confidentiality. There is no indication of remote code execution or denial of service from the provided data.

No official patch or remediation is currently available for this vulnerability. Since Plack::Middleware::XSendfile is deprecated as of version 1.0053 and planned for removal, users should consider migrating away from this middleware to alternative solutions. Until then, users should ensure that the middleware constructor or Plack environment explicitly restricts or sanitizes the X-Sendfile-Type header to prevent client-controlled path rewriting. Monitor vendor advisories for updates or official fixes.